Amendments to the claims : 

Please amend the claims as indicated below. Added text is 
underlined and deleted text is either struck through or shown in double 
enclosing brackets. Applicants aver that no new matter has been added. 



1 1. (Previously presented) A method to categorize e-mail messages 

2 received in a network, the method comprising: 

3 a) receiving information about an e-mail message sent to a 

4 recipient within an e-mail network, the received information including at 

5 least one of the following 

6 i) an actual sender of the e-mail message; 

7 ii) a final IP address used by the sender; 

8 iii) a final domain name used by the sender; and 

9 iv) an IP path used by the sender; 

10 b) storing the information; 

11 c) calculating statistics based on the stored information; 

12 d) using the calculated statistics to determine whether the 

13 received e-mail is unsolicited e-mail; and 

14 e) setting a predetermined threshold for accepting messages 
is based on statistics associated with one of the following 

16 i) an actual sender; 

17 ii) a final IP address; 

is iii) a final domain name; or 

19 iv) an IP path. 
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2. (Previously presented) The method of claim 1 wherein the actual 
sender is identified by a signature that includes at least two of the 
following fields from a message header: 



a) 


an e-mail address used by the sender; 


b) 


a display name used by the sender; 


c) 


a domain name used by the sender; 


d) 


the final IP address used by the sender; 


e) 


the final domain name used by the sender; 




a client software name used by the actual sender; 


g) 


user-agent; 


h) 


time zone; 


i) 


source IP address; 


j) 


sendmail version used by a first receiver; and 


k) 


the IP path used to route the message. 



3. (Previously presented) The method of claim 1 wherein the actual 
sender is identified by a signature including a range of IP addresses and 
at least one of the following fields from a message header: 

a) an e-mail address used by the sender ; 

b) a display name used by the sender; 

c) a domain name used by the sender; 

d) the final IP address used by the sender; 

e) the final domain name used by the sender; 

f) a client software name used by the actual sender; 

g) user-agent; 

h) time zone; 

i) source IP address; 

j) sendmail version used by a first receiver; and 
k) the IP path used to route the message. 
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1 4. (Previously presented) The method of claim 44 further comprising 

2 storing information about received messages in the at least one database, 

3 the information including at least two of the following: 

4 a) information identifying the actual sender; 

5 b) whether the actual sender is included on a recipient's 

6 whitelist; 

7 c) whether the actual sender is included on a recipient's 

8 blacklist; 

9 d) information identifying the final IP address; 

io e) whether the final IP address is included on the recipient's 

n whitelist; 

12 f) whether the final IP address is included on the recipient's 

13 blacklist; 

14 g) information identifying the final domain name; 

15 h) whether the final domain name is included on the recipient's 

16 whitelist; 

17 i) whether the final domain name is included on the recipient's 

18 blacklist; 

19 j) information identifying the IP path; 

20 k) whether the IP path is included on the recipient's whitelist; 

21 1) whether the IP path is included on the recipient's blacklist; 

22 m) whether the message could be categorized locally; and 

2 3 n) whether a recipient changed a whitelist/blacklist status of 

24 the message. 

1 5. (Previously presented) The method of claim 1 further comprising: 

2 storing the recipient statistics about at least one of the following: 

3 a) the actual sender; 

4 b) the final IP address; 

5 c) the final domain name; 

6 d) the IP path. 
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1 6. (Previously presented) The method of claim 1 wherein information 

2 stored about the actual sender includes at least one of the following: 

3 a) a total number of messages sent; 

4 b) a number of messages sent over a first predetermined time 

5 period; 

6 c) a total number of messages sent to recipients in the network 

7 who have included the actual sender on a whitelist; 

8 d) a number of messages sent to recipients in the network who 

9 have included the actual sender on the whitelist over a second 

10 predetermined time period; 

11 e) a number of recipients who know the actual sender; 

12 f) a total number of times a recipient changed 

13 whitelist/blacklist status of the actual sender; 

14 g) a number of times any recipient changed the actual sender's 
is whitelist/blacklist status over a third predetermined time period; 

16 h) a total number of messages sent to recipients in the network 

17 who don't know the actual sender; 

is i) a number of messages sent to recipients in the network who 

19 don't know the actual sender over a fourth predetermined time period; 

20 j) a total number of unique recipients in the network who have 

21 received at least one message from the actual sender; 

22 k) a total number of messages sent to unique recipients in a 
2 3 network who have included the actual sender on a whitelist; and 

2 4 1) a total number of messages sent to unique recipients in the 

2 5 network who have not included the actual sender on the whitelist. 
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1 7. (original) The method of claim 1 wherein information stored about 

2 messages sent from a final IP address includes at least one of the 

3 following: 

4 a) a total number of messages sent; 

5 b) a number of messages sent over a first predetermined time 

6 period; 

7 c) a total number of messages sent to recipients in the network 

8 who have included a sender on a whitelist; 

9 d) a number of messages sent to recipients in the network who 
10 have included the sender on the whitelist over a second predetermined 
n time period; 

12 e) a number of recipients who have whitelisted senders having 

13 the final IP address; 

14 f) a total number of times a recipient changed a 

is whitelist/blacklist status of any sender using the final IP address; 

16 g) a number of times a recipient changed the whitelist/blacklist 

17 status of any sender using the final IP address over a third predetermined 

18 time period; 

19 h) a total number of messages sent to recipients in the network 
2 o who have not included the sender on the whitelist; 

21 i) a number of messages sent to recipients in the network who 

22 have not included the sender on the whitelist over a fourth predetermined 

23 time period; 

2 4 j) a total number of unique recipients in the network who have 

2 5 received at least one message from at least one sender using the final IP 

2 6 address; 

27 k) a total number of messages sent to unique recipients in the 

2 8 network who have included the sender on the whitelist; and 

29 1) a total number of messages sent to unique recipients in the 

3 0 network who have not included the sender on the whitelist. 
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1 8. (original) The method of claim 1 wherein information stored about 

2 messages sent from a final domain name includes at least one of the 

3 following: 

4 a) a total number of messages sent; 

5 b) a number of messages sent over a first predetermined time 

6 period; 

7 c) a total number of messages sent to recipients in a network 

8 who have included a sender on a whitelist; 

9 d) a number of messages sent to recipients in the network who 
10 have included the sender on the whitelist over a second predetermined 
n time period; 

12 e) a number of recipients who have whitelisted senders using 

13 the final domain name; 

14 f) a total number of times a recipient changed a 

15 whitelist/blacklist status of any sender using the final domain name; 

16 g) a number of times a recipient changed the whitelist/blacklist 

17 status of any sender using the final domain name over a third 

18 predetermined time period; 

19 h) a total number of messages sent to recipients in the network 

20 who have not included the sender on the whitelist; 

21 i) a number of messages sent to recipients in the network who 

22 have not included the sender on the whitelist over a fourth predetermined 

23 time period; 

24 j) a total number of unique recipients in the network who have 

25 received at least one message from at least one sender using the final 
2 6 domain name; 

27 k) a total number of messages sent to unique recipients in the 

2 8 network who have included the sender on the whitelist; and 

29 1) a total number of messages sent to unique recipients in the 

30 network who have not included the sender on the whitelist. 
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1 9. (original) The method of claim 1 wherein information stored about 

2 messages sent using an IP path includes at least one of the following: 

3 a) a total number of messages sent; 

4 b) a number of messages sent over a first predetermined time 

5 period; 

6 c) a total number of messages sent to recipients in the network 

7 who have included a sender on a whitelist; 

8 d) a number of messages sent to recipients in the network who 

9 have included the sender on the whitelist over a second predetermined 
10 time period; 

n e) a number of recipients who have whitelisted senders using 

12 the IP path; 

13 f) a total number of times a recipient changed a 

14 whitelist/blacklist status of any sender using the IP path; 

15 g) a number of times a recipient changed the whitelist/blacklist 

16 status of any sender using the IP path over a third predetermined time 

17 period; 

18 h) a total number of messages sent to recipients in the network 

19 who have not included the sender on the whitelist; 

20 i) a number of messages sent to recipients in the network who 

21 have not included the sender on the whitelist over a fourth predetermined 

22 time period; 

23 j) a total number of unique recipients in the network who have 

24 received at least one message from at least one sender using the IP path; 
2 5 k) a total number of messages sent to unique recipients in the 
2 6 network who have included the sender on the whitelist; and 

27 1) a total number of messages sent to unique recipients in the 

2 8 network who have not included the sender on the whitelist. 



- 8 - 



A7:ABC-008.AMT 



1 10. (Currently amended) The method of claim 1 wherein the step of 

2 calculating statistics includes at least one of the following: 

3 a) determining a ratio of a first number of e-mail messages sent 

4 by an actual sender to recipients in the network who have included the 

5 sender on the whitelist in a predetermined time period divided by a second 

6 number of e-mail messages sent by an actual sender to users in the 

7 network in the predetermined time period; 

8 b) determining a ratio of a first number of recipients in the 

9 network who have included the sender on the whitelist divided by a 

10 second number of unique recipients in the network who received e-mails 

n from the actual sender in a predetermined time period; 

12 c) determining a ratio of a first number of times in a 

13 predetermined time interval a message from the actual sender was moved 

14 from a whitelist to a blacklist divided by a second number of times a 

15 message from the actual sender was moved from a whitelist to a blacklist; 

16 d) determining a ratio of a first number of times in a 

17 predetermined time interval a message from the actual sender was moved 

18 from a blacklist to a whitelist divided by a second number of times a 

19 message from the actual sender was moved from a blacklist to a whitelist; 

20 e) determining a ratio of a first number of unique users within 

21 the network who whitelisted the actual sender within a predetermined 

22 time period compared to a second number of unique users within the 

2 3 network who blacklisted the actual sender within the predetermined time 

2 4 period; 

2 5 f) determining a ratio reflecting whether the actual sender 

26 sends a majority of messages to recipients who have included the actual 

2 7 sender on the whitelist; 

28 g) determining a ratio reflecting a first number of wanted 

29 messages sent by the actual sender compared to a second number of 

30 unwanted or total messages sent by the actual sender; 
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h) determining a difference between a first number of expected 
messages sent by the actual sender and a second number of unexpected 
messages sent by the actual sender; 

i) determining a difference between a first number of times a 
user whitelisted a messages the actual sender and a second number of 
times a user blacklisted a message from the actual sender; 

j) determining a difference reflecting whether the actual sender 
sends a majority of messages to known recipients; 

k) converting any of the above ratios or differences to a score 
indicating the likelihood the message is unsolicited e-mail; and 

1) applying the score to the appropriate message in [[the]] a 
spam folder. 
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1 11. (Currently amended) The method of claim 1 wherein the step of 

2 calculating statistics includes at least one of the following: 

3 a) determining a ratio of a first number of e-mail messages sent by 

4 any sender using a final IP address to recipients in the network who have 

5 included the sender on the whitelist in a predetermined time period 

6 divided by a second number of e-mail messages sent by an any sender 

7 using the final IP address to users in the network in the predetermined 

8 time period; 

9 b) determining a ratio of a first number of recipients in the network 
10 who have included the sender on the whitelist divided by a second number 
n of unique recipients in the network who received e-mails from any sender 

12 using the final IP address in a predetermined time period; 

13 c) determining a ratio of a first number of times in a predetermined 

14 time interval a message from any sender using the final IP address was 
is moved from a whitelist to a blacklist divided by a second number of times 

16 a message from any sender using the final IP address was moved from a 

17 whitelist to a blacklist; 

18 d) determining a ratio of a first number of times in a predetermined 

19 time interval a message from any sender using the final IP address was 

20 moved from a blacklist to a whitelist divided by a second number of times 

21 a message from any sender using the final IP address was moved from a 

22 blacklist to a whitelist; 

2 3 e) determining a ratio of a first number of unique users within the 

2 4 network who whitelisted any sender using the final IP address within a 

2 5 predetermined time period compared to a second number of unique users 

2 6 within the network who blacklisted any sender using the final IP address 

2 7 within the predetermined time period; 

2 8 f) determining a ratio reflecting whether any sender using the final 
29 IP address sends a majority of messages to recipients who have included 

3 0 the sender on the whitelist; 
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31 g) determining a ratio reflecting a first number of wanted messages 

32 sent by any sender using the final IP address compared to a second 

33 number of unwanted or total messages sent by any sender using the final 
3 4 IP address; 

35 h) determining a difference between a first number of expected 

3 6 messages sent by any sender using the final IP address and a second 

3 7 number of unexpected messages sent by any sender using the final IP 

3 8 address; 

39 i) determining a difference between a first number of times a user 

4 0 whitelisted a message from any sender using the final IP address and a 

41 second number of times a user blacklisted a message from any sender 

42 using the final IP address; 

43 j) determining a difference reflecting whether any sender using the 

44 final IP address sends a majority of messages to recipients who have 
4 5 included the sender on the white list; 

4 6 k) converting any of the above ratios or differences to a score 

4 7 indicating the likelihood the message is unsolicited e-mail; and 
4 8 1) applying the score to the appropriate message in [[the]] a spam 

49 folder. 
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1 12. (Currently amended) The method of claim 1 wherein the step of 

2 calculating statistics includes at least one of the following: 

3 a) determining a ratio of a first [[of]] number of e-mail messages 

4 sent by any sender using a final domain name to recipients in the network 

5 who have included the sender on the whitelist in a predetermined time 

6 period divided by a second number of e-mail messages sent by an any 

7 sender using the final domain name to users in the network in the 

8 predetermined time period; 

9 b) determining a ratio of a first number of recipients in the network 
10 who have included the sender on the whitelist divided by a second number 
n of unique recipients in the network who received e-mails from any sender 

12 using the final domain name in a predetermined time period; 

13 c) determining a ratio of a first number of times in a predetermined 

14 time interval a message from any sender using the final domain name was 

15 moved from a whitelist to a blacklist divided by a second number of times 

16 a message from any sender using the final domain name was moved from 

17 a whitelist to a blacklist; 

18 d) determining a ratio of a first number of times in a predetermined 

19 time interval a message from any sender using the final domain name was 

20 moved from a blacklist to a whitelist divided by a second number of times 

21 a message from any sender using the final domain name was moved from 

22 a blacklist to a whitelist; 

23 e) determining a ratio of a first number of unique users within the 

2 4 network who whitelisted any sender using the final domain name within a 

2 5 predetermined time period compared to a second number of unique users 

2 6 within the network who blacklisted any sender using the final domain 

2 7 name within the predetermined time period; 

2 8 f) determining a ratio reflecting whether any sender using the final 
29 domain name sends a majority of messages to recipients who have 

3 o included the sender on the whitelist; 
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31 g) determining a ratio reflecting a first number of wanted messages 

32 sent by any sender using the final domain name compared to a second 

33 number of unwanted or total messages sent by any sender using the final 

34 domain name; 

35 h) determining a difference between a first number of wanted 

3 6 messages sent by any sender using the final domain name and a second 

37 number of unexpected messages sent by any sender using the final domain 

3 8 name; 

39 i) determining a difference between a first number of times a user 

4 0 whitelisted a message from any sender using the final domain name and a 

41 second number of times a user blacklisted a message from any sender 

42 using the final domain name; 

4 3 j) determining a difference reflecting whether any sender using the 

44 final domain name sends a majority of messages to recipients who have 

4 5 included the sender on the whitelist; 

4 6 k) converting any of the above ratios or differences to a score 

4 7 indicating the likelihood the message is unsolicited e-mail; and 
4 8 1) applying the score to the appropriate message in [[the]] a spam 

4 9 folder. 
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1 13. (Currently amended) The method of claim 1 wherein the step of 

2 calculating statistics includes at least one of the following: 

3 a) determining a ratio of a first number of e-mail messages sent 

4 by any sender using an IP path to recipients in the network who have 

5 included the sender on the whitelist in a predetermined time period 

6 divided by a second number of e-mail messages sent by an any sender 

7 using the IP path to users in the network in the predetermined time 

8 period; 

9 b) determining a ratio of a first number of recipients in the 
10 network who have included the sender on the whitelist divided by a 

n second number of unique recipients in the network who received e-mails 

12 from any sender using the IP path in a predetermined time period; 

13 c) determining a ratio of a first number of times in a 

14 predetermined time interval a message from any sender using the IP path 

15 was moved from a whitelist to a blacklist divided by a second number of 

16 times a message from any sender using the IP path was moved from a 

17 whitelist to a blacklist; 

is d) determining a ratio of a first number of times in a 

19 predetermined time interval a message from any sender using the IP path 

20 was moved from a blacklist to a whitelist divided by a second number of 

21 times a message from any sender using the IP path was moved from a 

22 blacklist to a whitelist; 

2 3 e) determining a ratio of a first number of unique users within 

24 the network who white listed any sender using the IP path within a 

25 predetermined time period compared to a second number of unique users 
2 6 within the network who blacklisted any sender using the IP path within 
2 7 the predetermined time period; 

2 8 f) determining a ratio reflecting whether any sender using the 

2 9 IP path sends a majority of messages to recipients who have included the 

3 0 sender on the whitelist; 
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31 g) determining a ratio reflecting a first number of wanted 

32 messages sent by any sender using the IP path compared to a second 

33 number of unwanted or total messages sent by any sender using the IP 

34 path; 

35 h) determining a difference between a first number of expected 

36 messages sent by any sender using the IP path and a second number of 

37 unexpected messages sent by any sender using the IP path; 

3 8 i) determining a difference between a first number of times a 

3 9 user whitelisted a message from any sender using the IP path and a 

4 0 second number of times a user blacklisted a message from any sender 

41 using the IP path; 

42 j) determining a difference reflecting whether any sender using 

43 the IP path sends a majority of messages to recipients who have included 

44 the sender on the whitelist; 

45 k) converting any of the above ratios or differences to a score 
4 6 indicating the likelihood the message is unsolicited e-mail; and 

4 7 1) applying the score to the appropriate message in [[the]] a 

4 8 spam folder. 

1 14. (original) The method of claim 1 further comprising revising statistics 

2 when a recipient changes a whitelist/blacklist status of one of the 

3 following: 

4 a) an actual sender; 

5 b) a final IP address; 

6 c) a final domain name; or 

7 d) an IP path. 

l 15. (canceled) 
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1 16. (Previously presented) The method of claim 1 further comprising 

2 accepting messages when information about the message exceeds the 

3 predetermined threshold. 

1 17. (Previously presented) The method of claim 1 further comprising: 

2 setting a low threshold to differentiate wanted messages from unsolicited 

3 messages, wherein the low threshold is either: 

4 a) greater than one percent of a number of messages that are 

5 accepted, wherein the messages are characterized by one of the following 

6 i) an actual sender; 

7 ii) a final IP address; 

8 iii) a final domain name; or 

9 iv) an IP path; 

io b) greater than one percent of a number of unique users 

n accepting a message characterized by one of the following 

12 i) an actual sender; 

13 ii) a final IP address; 

14 iii) a final domain name; or 
is iv) an IP path. 

1 18. (original) The method of claim 1 further comprising monitoring a 

2 recipient's spam folder at predetermined intervals to determine whether 

3 messages should be released. 
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19. (Currently amended) The method of claim 18 further comprising: 
automatically releasing the message from [[the]] a spam folder when the 
reputation of one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) an IP path; 

passes the predetermined threshold. 

20. (Currently amended) The method of claim 18 further comprising 
reevaluating [[the]] a spam folder immediately before it is displayed to the 
recipient such that information about messages in the spam folder is 
current when viewed by the recipient. 

21. (Previously presented) The method of claim 14 further comprising, 
when revising the statistics, more heavily weighting a manual reversal of 
the whitelist/blacklist status of one of the following: 

a) an actual sender; 

b) a final IP address; 

c) a final domain name; or 

d) anIPpath[[;]]. 

22. (original) The method of claim 5 wherein information about at least 
one of the following: 

a) the final IP address; 

b) the final domain name; and 

c) the IP path; 

is sent to the recipient when there is insufficient information about the 
actual sender. 
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1 23. (Previously presented) The method of claim 1 further comprising 

2 using the calculated statistics to compute a score indicating a likelihood 

3 that the received message is unsolicited e-mail. 

1 24. (Previously presented) The method of claim 1 further comprising each 

2 user setting a predetermined personalized spam threshold, wherein an 

3 incoming message that exceeds the spam threshold is sent to a folder 

4 designated to hold spam messages. 

1 25. (Previously presented) The method of claim 1 further comprising each 

2 user setting a predetermined personalized delete threshold, wherein an 

3 incoming message that exceeds the delete threshold is deleted. 

1 26. (Previously presented) The method of claim 1 further comprising 

2 maintaining at least four of the following values: 

3 a) a number of messages which were explicitly ranked good; 

4 b) a number of messages which were implicitly ranked good; 

5 c) a number of messages whose ranking is unknown; 

6 d) a number of messages which were explicitly ranked bad; and 

7 e) a number of messages which were implicitly ranked bad; 

8 wherein the values are based on messages having the same information 

9 about the sender including one of the following: 
10 i) an actual sender; 

n ii) a final IP address used by the sender; 

12 iii) a final domain name used by the sender; or 

13 iv) an IP path used by the sender. 

1 27. (original) The method of claim 26 wherein the values represent one of 

2 the following: 

3 a) message counts; or 

4 b) ratings of unique users within the network. 

- 19 - 



A7:ABC-008.AMT 



28. (Previously presented) The method of claim 26 further comprising at 
least four of the values being returned to the recipient to allow the 
recipient to apply different weights to a message in order to categorize the 
message. 

29. (original) The method of claim 1 further comprising evaluating an 
unknown sender based on statistics of one of the following: 

a) a known final IP address used by the sender; or 

b) a known final domain name used by the sender. 

30. (Previously presented) The method of claim 1 further comprising 
evaluating an unknown sender using either a known final IP address or a 
known final domain name based on statistics about other new senders 
using either the known final IP address or the known final domain name. 

31. (original) The method of claim 1 further comprising giving an 
unknown final IP address or final domain name an initial good rating. 

32. (original) The method of claim 1 further comprising giving an 
unknown final IP address or domain name an initial rating based on the 
length of time the network has been in operation. 

33. (Previously presented) The method of claim 1 further comprising 
using message ratings of earlier members of the network to overwrite the 
message ratings of later members of the network when the message 
ratings of the later members of the network are inconsistent with the 
message ratings of the earlier members of the network. 
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34. (original) The method of claim 23 wherein a final message score is 
determined by one of the following: 



wherein the scores for messages are based on statistics associated with a 
least two of the following: 



35. (Previously presented) The method of claim 46 wherein personal 
statistics are checked at the local database before global statistics at 
either the central database or the at least two centrally-maintained 
databases are checked. 

36. (Previously presented) The method of claim 1 further comprising 
rating a sender by: 

a) releasing a small number of a sender's messages to 
recipients; and 

b) monitoring a classification of the sender's messages received 
from the recipients. 

37. (Previously presented) The method of claim 1 further comprising 
changing a first user's rating when a plurality of other users outvote the 
first user's rating. 

38. (Previously presented) The method of claim 44 wherein one or more of 
the at least one database returns more than one value of ranking to the 
recipient. 



a) 
b) 



an average of two scores for a message; or 
a product of two scores for the message; 



i) 

ii) 

iii) 

iv) 



an actual sender of the message; 

a final IP address used by the sender; 

a final domain name used by the sender; or 

an IP path used by the sender. 
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39. (original) The method of claim 1 further comprising monitoring the 
inbox at predetermined intervals to determine whether messages should 
remain in the inbox. 

40. (original) The method of claim 23 wherein a first score for an 
unknown sender using a known final IP address or final domain name 
may be obtained by multiplying a second score for the final IP address or 
final domain name by a number less than one. 

41. (original) The method of claim 1 further comprising categorizing a 
received message that cannot be rated locally when user activity is 
observed. 

42. (Previously presented) The method of claim 1 further comprising 
using a subsequent formula to compute a score for the message when the 
message is reevaluated, wherein the subsequent formula differs from a 
first formula used to compute the previous message score. 

43. (Previously presented) The method of claim 1 further comprising 
sending the recipient a notification when any sender's reputation changes. 

44. (Previously presented) The method of claim 1 further comprising: 
maintaining at least one database; and 

including in the at least one database one of 

a) a central database; 

b) at least two centrally -maintained databases; and 

c) a local database. 

45. (Previously presented) The method of claim 44 further comprising 
storing the received information in the at least one database. 
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1 46. (Previously presented) The method of claim 44 further comprising 

2 maintaining the calculated statistics in the at least one database. 
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